Risk management, strategy and analysis from DeloitteCONTENT FROM OUR SPONSORPlease note: The Wall Street Journal News Department was not involved in the creation of the content below.

Text Size

Regular

Medium

Large

Google+

Print

Corporate Culture: The Center of Strong Ethics and Compliance

The lessons learned from scandals and organizational crises that trace back to the early 2000s make one thing clear: Without an ethical and compliant culture, organizations will be at risk. More and more, culture is moving from a lofty, “squishy” concept to something that should be defined, measured and improved.

Nicole Sandford

For example, culture is referenced by the U.S. Federal Sentencing Guidelines, which include expectations for organizations to promote an “organizational culture that encourages ethical conduct” and “compliance with the law.” The Organisation for Economic Co-operation and Development’s Convention on Combating Bribery of Foreign Public Officials in International Business Transactions refers to the importance of a strong culture of organizational ethics.

Ethics and compliance programs, as traditionally designed, are often not enough. “Organizations responsible for some of the most egregious acts of malfeasance have had quite impressive, formalized ethics and compliance guidelines,” says Nicole Sandford, Regulatory and Operational Risk Market leader for Deloitte Risk and Financial Advisory, Deloitte & Touche LLP. “Many regulators now realize that without a culture of integrity, organizations are likely to view their ethics and compliance programs as a set of check-the-box activities or—even worse—as a roadblock to achieving their business objectives,” Ms. Sandford adds.

Getting to a StrongCulture of Integrity

Strong cultures have two elements: A high level of agreement about what is valued and a high level of intensity with regard to those values. “In the long run, a positive culture of integrity is the foundation for an effective ethics and compliance program, which, when properly embedded into an organization, can create a competitive advantage and serve as a valuable organizational asset,” says Keith Darcy, an independent senior advisor to Deloitte & Touche LLP’s Regulatory and Operational Risk practice.

Keith Darcy

A culture of integrity also is generally characterized by:

—Organizational values: A set of clear values that, among other things, emphasizes the organization’s commitment to legal and regulatory compliance, integrity and business ethics.

—Tone at the top: Executive leadership and senior managers across the organization encourage employees and business partners to behave legally and ethically, and in accordance with compliance and policy requirements.

—Consistency of messaging:Operational directives and business imperatives align with the messages from leadership related to ethics and compliance.

—Middle managers who carry the banner: Front-line and mid-level supervisors turn principles into practice. They often use the power of stories and symbols to promote ethical behaviors.

—Comfort speaking up: Employees across the organization are comfortable coming forward with legal, compliance, and ethics questions and concerns without fear of retaliation.

—Accountability: Senior leaders hold themselves and those reporting to them accountable for complying with the law and organizational policy, as well as adhering to shared values or organizational values.

—The hire-to-retire life cycle: The organization recruits and screens employees based on character, as well as competence. The onboarding process steeps new employees in organizational values, and mentoring reflects those values. Employees are treated respectfully when they leave or retire.

—Incentives and rewards: The organization rewards and promotes people based, in part, on their adherence to ethical values. It is not only clear that good behavior is rewarded, but that bad behavior—such as achieving results regardless of method—can have negative consequences.

—Procedural justice: Internal matters are adjudicated equitably at all levels of the organization. “Employees may not always agree with decisions, but they are likely to accept them if they believe a process has been fairly administered,” notes Ms. Sandford.

A number of steps can help to reinforce culture and values:

Appoint a Chief Ethics Officer: Many organizations are taking this step to enhance the code of conduct and related controls and procedures, and improve accountability for ethical behavior through training and performance assessments.

Create listening posts: Conduct cultural assessments that get at the core of how people behave and what they think.

Maintain a healthy mood in the middle: Much hinges on middle management’s ability to translate tone at the top into the policies and practices that drive everyday behavior.

Keep it interesting: Find new and innovative ways to communicate cultural values and reward values-based behavior. Encourage storytelling to bring values to life.

Play fair: Reward the right behaviors and penalize the wrong ones. Don’t play favorites.

Shout it from the rooftops: Leaders tend to undercommunicate values and expectations. In this case, more is better.

Addressing Challenges to Establishing Ethics Programs

In establishing a strong culture of integrity and an ethics program, organizations may run up against a number of obstacles, but there are ways to meet such challenges:

—Defining the culture: Generally, leaders believe they understand and can define their organization’s culture. However, there can be a gap between management’s perception of the culture and how the rest of the organization views it. It is a mistake for leaders to assume they have their finger on the pulse of the organization’s culture at all times. To get a more accurate picture, organizations can establish listening posts, such as cultural assessments, using employee surveys and outside observers.

—Instilling culture and values throughout the organization: While executive leadership may work hard to establish a culture of integrity at headquarters, sometimes policies and communications get lost in translation as one moves further from the central office. Attention to culture needs to be active and continuous, especially in large organizations with distant outposts.

—Extending cultural values in M&A: Cultural fit is one of the biggest stumbling blocks in integrating a merged or acquired organization; in fact, it is one reason such transactions fail, despite the potential business benefits. Executives may want to conduct a cultural “audit” as part of the due diligence process. If the target company’s values diverge significantly from those of the buyer, that could be a red flag. A well-developed integration plan can help both entities understand and reinforce desired values.

—Handling naysayers: Nothing can damage culture more than the malcontents. They can cause roadblocks and undermine the efforts of the organization. They should be identified, counseled and offered the opportunity to conform to expected behavior, or consideration should be given to separating them from the organization.

—Battling values fatigue: While ongoing communication is essential, organizations should avoid delivering exactly the same message again and again as it could get stale, causing employees to ignore the underlying values and principles. Communicating values is much like a marketing campaign—it needs to capture people’s attention and use different content, formats, and communication channels to remain fresh. One way to achieve this level of interest is through the power of stories.

—Addressing leadership flux: When organizations experience rapid turnover of CEOs and other senior leaders, maintaining a consistent identity and set of values can be a challenge. Selecting the “right” individuals to lead the organization is critical. If everyone in the organization lives its values, then promoting from within is one way to ensure those values remain intact. But that is not always practical or possible. “When hiring senior leaders, especially CEOs, boards need to pay particular attention to cultural fit and consider candidates who are not only competent, but who have the chemistry, character and moral capability to inspire and win the hearts and minds of all stakeholders,” observes Mr. Darcy.

—Appealing to a cross-generational workforce: Employee turnover can undermine an organization culture as well. Organizations today need to appeal to the most multi-generational workforce in history. To create cultures with staying power, organizations should foster an environment that balances a “something for everyone” appeal, with a set of consistent values that all generations will be able to embrace.

An organization is a community of people with common interests and shared values, banded together to achieve a common goal. “Building a culture of integrity not only fortifies the organization against risk, but also builds both employee engagement and strong loyalties with all stakeholders,” says Mr. Darcy.

Related Deloitte Insights

Culture is often an overlooked foundation of an organization’s strategy and performance. Yet today diagnostic tools, cognitive analytics, risk sensing and other technologies can provide organizations insights into day-to-day risk factors embedded within their cultures. Carey Oven, Deloitte Risk and Financial Advisory partner, Deloitte & Touche LLP, discusses the challenges organizations face in improving their culture risk profile and ways they can help protect their culture and monitor risks that could damage it.

As chief risk officer of American Express, Paul Fabara is remaking compliance and risk management by driving the use of technology and data analysis, including development of an early-warning system to detect potential risks. He discusses how he has worked with the business units and board to carve out a new role for compliance and risk and how the functions have ramped up to contribute to decision-making at the operational and strategic levels, with Ash Raghavan, principal, Deloitte Risk and Financial Advisory, Deloitte & Touche LLP.

The recently passed tax legislation is expected to have significant and immediate financial reporting impacts on organizations. “The enactment of the new tax law in the closing days of 2017 presented a major challenge for publicly traded companies that are required to account for and disclose the effects of a change in tax law in the period of enactment,” notes Steve Kimble, chairman and CEO, Deloitte Tax LLP. Learn about the tax law changes that could have a significant financial statement impact, including in the areas of deferred tax assets and liabilities, recognition of a foreign subsidiary liability and tax credits.

Views & Analysis

Although board seats don’t become available all that often, as more organizations broaden their definition of diversity the pool of potential candidates is expanding. What does it take to land such a spot? Industry and international experience, a knowledge of risk and technology issues, and personal traits that range from intellectual curiosity to unassailable integrity are just some of the qualities and qualifications that matter. Learn how to assess your viability and what steps you might take to enhance your appeal to search committees.

Continued uncertainty about the economy and increased regulation across several industries have required a more informed and efficient use of capital. Working with management, the board of directors can play a fundamental role in the capital allocation process through its oversight function, including participating in strategy development, examining risks, comparing strategy to results and focusing on key investment terms. Understand how boards can help guide the capital allocation process by challenging business plans and strategy, and reviewing capital allocation alternatives, among other efforts.

As proxy season approaches, several governance issues and proposals are likely to emerge, reflecting shareholders’ increased attention to how companies’ stances on governance matters can impact shareholder value, according to Carol Schumacher, who has held roles as investor relations (IR) officer and corporate affairs officer at a Fortune 10. She discusses shareholders’ expectations for the governance information that management provides, and what IR can do to help companies respond, in a conversation with Sanford Cockrell III, U.S. national managing partner, CFO Program, Deloitte LLP.

Editor's Choice

Boards and C-suite executives overwhelmingly see risk as having an important role in value creation, but just 17% of respondents say they are actively using risk to drive returns, according to a new global survey from Deloitte. The survey also found that senior stakeholders want chief risk officers to spend significantly more time playing the strategist role, with a majority of respondents saying their risk officers should participate more in setting the strategic direction of the company and aligning risk management strategies accordingly.

Traditionally, internal audit (IA) has focused on providing assurance with respect to known risks and the effectiveness of controls in mitigating those risks. Regulators, however, are increasingly interested in an organization’s ability to identify blind spots and other vulnerabilities that may undermine the integrity of the risk management environment, including the risk of misconduct. IA functions can play a pivotal role by substantively testing culture and identifying potential risk-related outliers that may not be visible via other means, such as supervisory frameworks, escalations, compliance assessment and testing, and previous audits.

Identifying and managing strategic risks can be a difficult task. To add to the challenge, many companies have traditionally separated their risk and strategy functions and think of risk as more of a compliance responsibility rather than a dynamic tool for value creation, business performance management and growth. However, companies that align strategy and risk can be better served to allow for a process of “strategic resiliency,” which involves anticipating, knowing and acting on risks when introducing or executing new strategies as a way of increasing the chances of success in spite of uncertainty.

About Deloitte Insights

Deloitte’s Insights for C-suite executives and board members provide information and resources to help address the challenges of managing risk for both value creation and protection, as well as increasing compliance requirements.